Publication:
A Model Extraction Attack on Deep Neural Networks Running on GPUs

Simple item page
dc.contributor.advisorSandip Kundu
dc.contributor.authorO'Brien Weiss, Jonah G
dc.contributor.departmentUniversity of Massachusetts Amherst
dc.contributor.departmentElectrical & Computer Engineering
dc.date2023-11-02T21:44:32.000
dc.date.accessioned2024-04-26T18:12:11Z
dc.date.available2024-04-26T18:12:11Z
dc.date.submittedMay
dc.date.submitted2023
dc.description.abstractDeep Neural Networks (DNNs) have become ubiquitous due to their performance on prediction and classification problems. However, they face a variety of threats as their usage spreads. Model extraction attacks, which steal DNN models, endanger intellectual property, data privacy, and security. Previous research has shown that system-level side channels can be used to leak the architecture of a victim DNN, exacerbating these risks. We propose a novel DNN architecture extraction attack, called EZClone, which uses aggregate rather than time-series GPU profiles as a side-channel to predict DNN architecture. This approach is not only simpler, but also requires less adversary capability than earlier works. We investigate the effectiveness of EZClone under various scenarios including reduction of attack complexity, against pruned models, and across GPUs with varied resources. We find that EZClone correctly predicts DNN architectures for the entire set of PyTorch vision architectures with 100\% accuracy. No other work has shown this degree of architecture prediction accuracy with the same adversarial constraints or using aggregate side-channel information. Prior work has shown that, once a DNN has been successfully cloned, further attacks such as model evasion or model inversion can be accelerated significantly. Then, we evaluate several mitigation techniques against EZClone, showing that carefully inserted dummy computation reduces the success rate of the attack.
dc.description.degreeMaster of Science in Electrical and Computer Engineering (M.S.E.C.E.)
dc.identifier.doihttps://doi.org/10.7275/35614344
dc.identifier.orcidhttps://orcid.org/0009-0005-4119-7887
dc.identifier.urihttps://hdl.handle.net/20.500.14394/32978
dc.relation.urlhttps://scholarworks.umass.edu/cgi/viewcontent.cgi?article=2386&context=masters_theses_2&unstamped=1
dc.rights.urihttp://creativecommons.org/licenses/by/4.0/
dc.source.statuspublished
dc.subjectmodel extraction
dc.subjectadversarial machine learning
dc.subjectmachine learning
dc.subjectside-channel attack
dc.titleA Model Extraction Attack on Deep Neural Networks Running on GPUs
dc.typeopenaccess
dc.typearticle
dc.typethesis
digcom.contributor.authorisAuthorOfPublication|email:jgow98@gmail.com|institution:University of Massachusetts Amherst|O'Brien Weiss, Jonah G
digcom.identifiermasters_theses_2/1293
digcom.identifier.contextkey35614344
digcom.identifier.submissionpathmasters_theses_2/1293
dspace.entity.typePublication
Files
Original bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
O_Brien_Weiss.pdf
Size:
4.48 MB
Format:
Adobe Portable Document Format
Name: O_Brien_Weiss.pdf
Size: 4.48 MB
Kind: Adobe PDF
Collections
Masters Theses